Phishing and browser threats
Most attacks in a browser want one of three things: your password, your login session or your card number. These guides explain how each attack works, how to spot it and what stops it.
Attacks on your logins
Phishing attacks
Fake pages and messages that get you to hand over a password. How they work, with real examples.
QR code phishing
Malicious links hidden behind a code you scan, which can slip past email filters.
Session hijacking
Stealing the login cookie your browser keeps, which can get around your password and 2FA.
Credential stuffing
Automated logins that try passwords leaked in one breach on your other accounts.
Attacks hidden inside a page
Formjacking
Malicious JavaScript on a real checkout page that copies card numbers as you type.
Hidden iframes
Invisible frames behind clickjacking, credential harvesting, crypto mining and ad fraud.
SSL stripping
A man-in-the-middle attack that removes HTTPS without you noticing, and why HSTS is not a complete fix.
Scams that use fear
If something already happened
- I clicked a phishing link: an interactive recovery checklist, with where to report it.
- What to do after a phishing attack: the first steps, in order.
- How to remove fake virus popups: for warnings that keep coming back.
Check something now
- Phishing link checker: paste a URL before you open it.
- Phishing email checker: paste a message and see the red flags.
- QR code scanner: see where a code leads before you visit it.
The data behind these guides
Our phishing URL statistics count where live phishing links are hosted, using PhishTank's verified list. For ways to protect yourself automatically, see how the best anti-phishing browser extensions compare.
Last updated: